Firewall against firewall – bypassing an IPS

In this post we are going to explain how we used iptables to bypass an Intrusion Prevention System during a recent penetration test.

During the first phase of a penetration test on a /24 network, we started performing routinary network port scan to identify available services listening for connections. During the network port scan we identified that the target network was protected by an IDS, as nmap reported that every port was open, which was obviously not the case. Clearly, the IDS was replying with SYN/ACK packets and nmap interpreted that as open ports:

A close examination of the traffic returned by the target host revealed that there was a difference between the responses received from an open port and the responses received from the IDS.

The tool _hping3_ was used to verify the packets from each port. The following is an example of the traffic returned by an open port listening on the target host:

There is, of course, nothing special about the output shown above. However, when we ran hping3 against port 444 (presumably not open) the output generated was as follows:

The TCP window size is zero, and the TTL values are 36 or 39.

In theory, a TCP window size of zero indicates that the target host can not cope with the current network workload, and therefore network clients should decrease the throughout. This is a well known defensive technique called Tarpit which is used in an attempt to delay network port scans.

This difference in the TTL and TCP window values would be enough for an attacker to bypass the IDS. The attacker would just need to discard network traffic with TTL values of 36 and 39 or TCP window size of zero.

The following command will do the job for this particular scan:

The next thing left to do is to rerun the scan. Importantly, nmap uses raw sockets when performing the scan as root, and therefore would actually have access to the network traffic before iptables drops the packets. For that reason, the network scan should be then ran from a non-privileged account.

As you can see, we used a firewall (iptables) against a firewall (the IPS)